A Day in the Life of a Cyber Security (SOC) Analyst (MSSP)

Поделиться
HTML-код
  • Опубликовано: 28 ноя 2024

Комментарии • 133

  • @MyDFIR
    @MyDFIR  Год назад +7

    SIGN UP FOR FREE MENTORSHIP
    Getting started in Cybersecurity is difficult and you don't have to do it alone. Let me help you in your journey by providing you with tips to put you on the right path.
    ▸Sign up for FREE here: MyDFIR.com

  • @joshholmes1372
    @joshholmes1372 Год назад +6

    This video just makes me happy we run a tierless soc. Everyone is trained on an expected to know how to do almost everything except somw admin stuff.

    • @MyDFIR
      @MyDFIR  Год назад +1

      Thats awesome - I’ve seen some of these and they work wonders.

    • @ericperry72
      @ericperry72 8 месяцев назад

      What company?

  • @callmebigpapa
    @callmebigpapa Год назад +15

    Just remember VT is not perfect. Blue Teaming really is a Team sport. The scope of what you have to know is vast. You need lots of brains so use your teammates. Also AI is helping now with some analysis. Also Cyberchef for the win!

    • @MyDFIR
      @MyDFIR  Год назад +2

      Love this - You are absolutely correct. I've seen SOC analysts rely on VT to the point where if it is green == safe. There is such a thing called evasion, 0 days etc. Keeping this in mind and look for CONTEXT will help you fully understand what you are looking at. Couldn't agree more with the team sport. Communicate, collaborate and you'll be golden.
      Cyberchef ♥

    • @johndank2209
      @johndank2209 5 месяцев назад

      @@MyDFIR what do you do if virustotal doesn't recognize a specific process hash?

  • @neverhomepnw
    @neverhomepnw Год назад +18

    Thanks for making things simple to understand. I am studying for CYSA+ and looking to start off as a SOC. Looking forward to more videos!

    • @MyDFIR
      @MyDFIR  Год назад

      Thanks for watching! Best of luck on the cert and your job hunt

  • @distinguishedcatt
    @distinguishedcatt Год назад +21

    This kind of videos happen once in a blue in my recommendation! I'm 101% fan. And I loved that you are very concise. Keep it up, I'm looking forward to seeing your new videos

    • @MyDFIR
      @MyDFIR  Год назад

      Thanks for the kind words ❤️ videos every tuesday & thursdays!

  • @kcjam
    @kcjam Год назад +17

    Hey man, I just started as a SOC Analyst last June 5. It's almost a month now and all you're saying is literally the summary of a Tier 1 SOC Analyst. Great video man :D

    • @MyDFIR
      @MyDFIR  Год назад +2

      Thanks! Congrats on starting as a SOC analyst! How is it so far? Do you enjoy it?

    • @saywhat4229
      @saywhat4229 Год назад +1

      Did you get the job without a degree ?

    • @kcjam
      @kcjam Год назад

      @@saywhat4229 I have a degree in Electronics Engineering

    • @Vyper443
      @Vyper443 Год назад +1

      on-site or remote yung work mo?

    • @kcjam
      @kcjam Год назад

      @@Vyper443 on-site po

  • @infini.tesimo
    @infini.tesimo 26 дней назад

    This was a lot more in-depth of what to expect for a SOC position than many videos I've seen. I'm entertaining the idea of going through an online bootcamp for cybersecurity to become one as I have been in the tech space for a while and worked queues, just never for this purpose and I feel like I could get it down pat to increase income. Thanks for the info! Subbed.

    • @MyDFIR
      @MyDFIR  26 дней назад

      My pleasure! Just a word of caution, try not to fall into the trap of “guarantee” bootcamps!

  • @thatboisam2378
    @thatboisam2378 Год назад +6

    Good video, I'm currently an intern for the service desk and a rising sophomore at college, which hopes of being an analyst. Thanks for the information.

    • @MyDFIR
      @MyDFIR  Год назад +2

      Awesome! Experience in service desk would compliment your skills overall, not just in cybersecurity. Great start and if needed, let me know how I can help!

  • @gokusguns8818
    @gokusguns8818 Год назад +18

    I just finished my first week as a SOC Analyst I and this is one of the best videos explaining the day in the life, good job bro keep it up!
    Do you have any tips on how to know what to look for/know it is normal?

    • @MyDFIR
      @MyDFIR  Год назад +9

      That is a great question. First - Congratulations on becoming a SOC Analyst!!!
      In terms of tips on how to know what to look for - This is a topic that I love talking about. I want to introduce you to the MITRE ATT&CK framework. This should provide you with some understanding of what to look for as MITRE will introduce you what a threat actor may perform to reach their objectives. As for "know it is normal", each organization will be different so I cannot explicitly say that is bad and that is good. Instead, I'll direct you to SANS FOR508 poster and combining the two, MITRE ATT&CK with SANS Poster, you should be in good hands.
      MITRE: attack.mitre.org/
      SANS: www.sans.org/posters/hunt-evil/
      I hope that helps.

    • @Nick-jo1cm
      @Nick-jo1cm Год назад +1

      I am having a hard time landing my first SOC analyst position. Any advice, also cheers on the new job!

    • @johnvardy9559
      @johnvardy9559 Год назад +1

      could you give us some inforamtions,which tools did you used and was that , great to hear that.

    • @johnvardy9559
      @johnvardy9559 Год назад

      Goku give us some Tips.

    • @nikkiem.4573
      @nikkiem.4573 Год назад

      Congratulations on your new role! If I may ask, slightly off-topic, how long did it take to get hired from your application to your first day?

  • @ABDELZEMIHORIOUATTARA
    @ABDELZEMIHORIOUATTARA Год назад

    Hello sir

    Thank you for the video, and we support you with new video to help us better understand our environment as an analyst soc MSSP.

  • @ohlookitsalex
    @ohlookitsalex Год назад +6

    this was incredibly helpful!!!

    • @MyDFIR
      @MyDFIR  Год назад

      Thanks! I am happy to hear that 😁

  • @bluemarvel697
    @bluemarvel697 Год назад +7

    Unfortunately, In some SOCs the T2 doesn't know much more than the T1 so getting assistance on new alerts isn't so easy in those circumstances.
    What would you suggest in those situations?

    • @MyDFIR
      @MyDFIR  Год назад +1

      Great question and I've experienced that quite a bit unfortunately. In those cases, I'll try and look for documentation on those alerts. Typically there is a master file of alerts/usecases with definitions and what it is trying to look for/alert on. IF there is no such document, ask amongst your peers and see if they are able to assist

  • @ABDELZEMIHORIOUATTARA
    @ABDELZEMIHORIOUATTARA Год назад +1

    I'm a SOC analyst, but as a beginner, in our department, we lack processes and documentation. This causes us to often get stressed about alerts. I'd like to have some examples of processes and documentation that a soc analyst can use. It will help me a lot as well as our service.
    Thank you in advance for your reply.

    • @MyDFIR
      @MyDFIR  Год назад

      It really depends on each organization however you mentioned "we lack processes and documentation" what exactly are you missing? or how do you know you are lacking processes/documentation?
      The answer to that question is where you put your focus on building said documentation.
      For example, not sure what a certain alert means? or how to track false positives? Create documentation on it and outline the steps.
      Hope that helps!

  • @0xC47P1C3
    @0xC47P1C3 6 месяцев назад

    Lab work, lab work, lab work. Nothing beats getting your hands dirty with this stuff

    • @MyDFIR
      @MyDFIR  6 месяцев назад

      100% agreed!!

  • @Vyper443
    @Vyper443 Год назад +2

    I have been looking for these kind of videos. Thanks for the explanation man 👊

    • @MyDFIR
      @MyDFIR  Год назад +1

      Glad you enjoyed it!

    • @Vyper443
      @Vyper443 Год назад

      Did you get any certifications before entering cs?

    • @MyDFIR
      @MyDFIR  Год назад

      @@Vyper443 The only certificate I had was CCNA. I had 1 year work experience in IT Support prior to starting my first role in cs.

  • @lamilem5615
    @lamilem5615 Год назад

    Thank you 🙏

    • @MyDFIR
      @MyDFIR  11 месяцев назад

      Thanks for watching ❤️

  • @KenPryor
    @KenPryor 11 месяцев назад

    Just found your channel yesterday and I'm really liking your videos. I think I'd love working in a SOC but have to wonder if I'm too old. I'm a retired police officer/digital forensic guy and used to hold the GCFA, but that's been about 8 years ago. Not sure if I''m past the point of getting into something like this. Anyway, really liking your content and keep up the great work!

    • @MyDFIR
      @MyDFIR  11 месяцев назад +2

      You’re never too old. If you want to do it I’d say go for it! Try and apply and see what happens 😁

  • @PCX425
    @PCX425 5 месяцев назад

    Are you finding yourself doing a lot of research after normal work hours to keep up with new security threats or are you learning as you monitor and investigate these issues?

    • @MyDFIR
      @MyDFIR  5 месяцев назад +1

      Great question - When I was working in a MSSP, it was quite difficult to do any research or learning due to the fast paced environment. After a shift I would be mentally drained and wouldn’t want to do anything outside of work.
      But long story short, i learned on the fly. I tried leaning on senior analysts, reviewed others work and tried to understand why/how they came to that conclusion. As for learning new threats, I tried to take 30minutes to read whats happening around the industry before I began my shift.

  • @OLAScape_
    @OLAScape_ Год назад

    Thank you for this, this is absolutely helping with my career choice in joining CyberSec. Theres a lot of videos talking about the pay/WFH aspect, but people need to realize no job with that pay is sunshine and rainbows. With that being said i feel like anyone with a desire to learn and get knee deep in a problem will have a good time in this industry and be rewarded accordingly. Thanks again for the fantastic video.

    • @MyDFIR
      @MyDFIR  Год назад +1

      YES!! For me, the correct mindset is required to excel in this field. "I feel like anyone with a desire to learn and get knee deep in a problem will have a good time in this industry and be rewarded accordingly. " - Spot on my friend.

    • @OLAScape_
      @OLAScape_ Год назад

      @@MyDFIR HA! Well i'm glad i have the right mindset. Currently i'm working as a Jr. sys admin mostly making automation scripts and such for our company to keep track of all our networks, but eventually im hoping to making the tranisiton in to CyberSec once i actually get some certs for that pesky HR software lol...

    • @MyDFIR
      @MyDFIR  Год назад

      @@OLAScape_ 🤣those darn pesky HR software... You know how to find me if you have any questions!

  • @cuddy90210
    @cuddy90210 Год назад +1

    Very nice video, thank you so much!.. I'm strongely thinking about becoming a Security Analyst... how realistic is it to expect to work a (Monday thru Friday/9 to 5) schedule?

    • @MyDFIR
      @MyDFIR  Год назад +2

      If you are planning on becoming a JR SOC analyst, those hours are quite rare and typically given to senior analysts (tier 2/3 for example). However, some SOCs have offices all over the world so 9-5 might actually work but in most cases, I have not seen this except during the probation periods (first 3 month of hiring).
      I'd say don't let that dissuade you, instead break into the field and work your way up. You'll land that 9-5 sooner than you think :)

  • @cryptomarkla69
    @cryptomarkla69 Год назад +1

    Thank you for the video!

    • @MyDFIR
      @MyDFIR  Год назад +1

      Anytime! Hope you enjoyed it 😃

  • @skyscope8409
    @skyscope8409 Год назад +1

    Just passed my Comptia Security + but I don't have any other IT work experiences. Do you think i should apply for a SOC tier 1 role or until i get the Comptia Network+ as well? Thanks!

    • @MyDFIR
      @MyDFIR  Год назад +1

      You can apply but simply having a certificate likely will not be enough. Network+ is great to reinforce your networking knowledge and ill always stand by it however, I would recommend tackling some labs and target those job specific related skills as well.

  • @Wesjapa100
    @Wesjapa100 Год назад

    Thanks for this overview!
    How often do you use SQL, Linux or Python at your job, or if you use either at all?
    Just seems to me that everything taught on Google Cert is kind of overwhelming, I mean, there are different instructors for each course/skill so I don't think one person can be very good in all those skills, but at the same time, if they teach all of that, are we supposed to know that all when we are starting???

    • @MyDFIR
      @MyDFIR  Год назад +1

      Great question! It all boils down to the role and responsibility. Where I al at, I maybe use Python 5% of the time? That is me trying to craft a quick script or modify an existing script but that is about it. However, compare that to Linux, I use that almost every time when I am involved in Incident Response.
      In short, agree that it can be overwhelming but take these as “good to know” vs trying to be an expert at it. It is a good idea to be exposed to these and have a basic understanding.
      Hope that helps!

    • @Wesjapa100
      @Wesjapa100 Год назад

      @@MyDFIR Yeah, I realised that I need to understand better the roles and focus/improve on 1-2 skills to get started and after that, I can go back to the other "good to know" skills to grow in the profession. Changing careers is really challenging. 😅
      Cheers! )

  • @treninajohnson3304
    @treninajohnson3304 Год назад +2

    Thank you for this video! Do you mind sharing how you got into this role? Did you start at Help Desk?

    • @MyDFIR
      @MyDFIR  Год назад +2

      I am glad you enjoyed it! - I did start off my career as a Help Desk analyst and eventually transitioned into cyber security about a year into that role.
      My journey on how I got started: ruclips.net/video/npgMSETCKfM/видео.html

    • @treninajohnson3304
      @treninajohnson3304 Год назад

      @@MyDFIR Awesome! I should be hearing back today for a Help Desk role. I'm trying to decide which sector I would like to go into, but as for now, I'm going to focus on my experience at Help Desk and hopefully it provides some clarity for me.

    • @MyDFIR
      @MyDFIR  Год назад +1

      @@treninajohnson3304 Sweet! Best of luck to you! If you ever need someone to bounce ideas off of, I am always happy to help.

    • @MyDFIR
      @MyDFIR  11 месяцев назад +1

      Hey! Just wondering if you heard back from getting that help desk role?

    • @treninajohnson3304
      @treninajohnson3304 11 месяцев назад

      @@MyDFIR hello! No, I didn't. I landed a sales job as a Business Development Representative and I hate it! It was very hard to land a help desk job with my lack of skills. Thanks for checking in.

  • @librev5881
    @librev5881 8 месяцев назад

    I currently work at an SOC as an alarm monitor, do you have any recommendations on how this may relate to security work? I am currently finishing up my Google cybersecurity certificate and then it will be on security+

    • @MyDFIR
      @MyDFIR  8 месяцев назад

      Hm I could assume what that role entails but if you could provide me with some more details I could see how it might relate. Great path so far!

  • @johnflorence2672
    @johnflorence2672 Год назад

    leaving tier 2 firewall vendor support to pursue a soc carreer, I understand how hectic it gan get, but not having to make customer calls and fixing their company bad implementation (and ofc blaming the vendor device) is a plus +++ to me, idk, maybe I'm just burnt with customer support

    • @MyDFIR
      @MyDFIR  Год назад

      Bad implementation 😂 these make me cry when I am doing an IR… especially if they are using default settings

  • @Ricknroll9
    @Ricknroll9 Год назад +1

    Thanks, great video. I like to see content like this bc keep me motivate to studying and get a job as soc analyst
    #BlueTeam

    • @MyDFIR
      @MyDFIR  Год назад +1

      Love it - stay motivated, you’ll get there.

  • @welovefootball2026
    @welovefootball2026 Год назад

    After obtaining the security+ snd CASY+, which cert do you think should be next?

    • @MyDFIR
      @MyDFIR  Год назад

      Depending on what your domain of interest is in, you could go for Blue Team Level One. However I would recommend making sure you dedicate some time for hands on lab work as well

    • @H4R4K1R1x
      @H4R4K1R1x Год назад

      I love BTL1, just finished their BTJA. Quality platform/cert IMO@@MyDFIR

  • @christofer-k3o
    @christofer-k3o Год назад

    nice explanation, thank you sir

    • @MyDFIR
      @MyDFIR  Год назад

      Thanks for watching!

  • @YaseenAliKhan804
    @YaseenAliKhan804 Год назад

    I am your 50th Subscriber

    • @MyDFIR
      @MyDFIR  Год назад

      Thank you!! Never thought I would hit 50 subscribers this quick 😭 super grateful

  • @johnvardy9559
    @johnvardy9559 Год назад

    which tools you need for network analysis ?

    • @MyDFIR
      @MyDFIR  Год назад +1

      I typically use wireshark if the pcap is not too large otherwise ill utilize Zeek, tcpdump. These are great tools for network analysis.

    • @johnvardy9559
      @johnvardy9559 Год назад

      @@MyDFIR glad to hear that,also im trying to learn wireshark i spent a lot of time and i found already more than 4-5 tools and i feel overhwelmed.Also for tcpdump any resource? i though what was only for real capture nothing else.

    • @MyDFIR
      @MyDFIR  Год назад +1

      @@johnvardy9559 TCPDump can capture and read packets. I usually combine that with egrep with awk/cut to really help with the output. Some people also like to use ngrep however, I've yet to use that actually.. I should probably try it out. The key here is focus on 1 tool for now which I recommend is Wireshark. This tool has helped me in many investigations, great resource to get comfortable in.

    • @johnvardy9559
      @johnvardy9559 Год назад

      @@MyDFIR hi There, about nmap is something we need?

    • @MyDFIR
      @MyDFIR  Год назад +1

      @@johnvardy9559 something we need? Not really but something to know about? Sure. As a SOC analyst you likely won’t need to use nmap but it is a tool that doesn’t hurt to learn.

  • @RoryM_
    @RoryM_ Год назад

    Good advice, cheers dude! subbed.

  • @johnvardy9559
    @johnvardy9559 Год назад

    Which tools you use more in the days tasks?

    • @MyDFIR
      @MyDFIR  Год назад +1

      Various types of tools as it will depend on your clients. Typically expect some sort of cloud based solution so the Microsoft stack (Defender for xyz, Azure Sentinel) or mix of CrowdStrike, Chronicle and/or Splunk.

    • @johnvardy9559
      @johnvardy9559 Год назад +1

      @@MyDFIR I think Cloud become "must".I'm thinking BLT1 cert do you recommend as a first cert or to go on Cloud?
      Thanks your feedback was incredible with sense.

    • @MyDFIR
      @MyDFIR  Год назад +1

      @@johnvardy9559 If I had to choose, I would go with BLT1. Yes the cloud is becoming a "must" but learning how to investigate should be primary focus if you want to get into a SOC environment. After, I would focus on getting some familiarity with the cloud.

    • @johnvardy9559
      @johnvardy9559 Год назад

      @@MyDFIR you are the best thanks for everything

  • @Unforgettableblackness
    @Unforgettableblackness Год назад

    How can i become a SOC what are the steps to start

    • @MyDFIR
      @MyDFIR  Год назад +3

      I am assuming you are asking how can you become a SOC ANALYST vs becoming an actual SOC 😂 - Start your fundamentals, identify areas where you are weak in (IT/Network/Security) and work towards improving that. Then start to look for hands on experiences, there are free ones out there. Work on networking with people in this industry, update your resume and have a blog/github or anything to showcase your projects. - Afterwards, you can try to find a SOC related junior position.
      Hope that helps!

  • @koushikraj9815
    @koushikraj9815 Год назад

    Can make video for example. So that I can under process deeply and directly apply as experienced job. All fresher job asking min 6 months eco but how can get eco fresher

    • @MyDFIR
      @MyDFIR  Год назад

      Hey! To clarify, did you want me to create a video on how to obtain experience?

  • @1haychem
    @1haychem Год назад +2

    hey bro, im going to start cybersecurity next year, would you say it’s good to get a degree in it and to get certs at the same time?
    will it look good when applying for jobs in the future?

    • @MyDFIR
      @MyDFIR  Год назад +1

      Yup, if you have the time and resources, i would highly encourage that. The certs should help compliment your knowledge learned via degree. I would also throw in there some hands on experience as well. Good luck!

  • @ksherman51
    @ksherman51 Год назад

    greatvideo thanks! should make a discord

    • @MyDFIR
      @MyDFIR  Год назад

      Thank you! Discord is in the works 😀

  • @VanguardxGaming
    @VanguardxGaming Год назад

    Is $50-60k for a tier 1 soc analyst kinda on par ?

    • @MyDFIR
      @MyDFIR  Год назад +1

      That is pretty much spot on. Of course depending on where you live/work will be a factor.

  • @Dahlah.FightMe
    @Dahlah.FightMe Год назад +1

    Nice :D
    New Subscriber on 2,12k :v

    • @MyDFIR
      @MyDFIR  Год назад

      Thanks for subbing and supporting the channel!

  • @intelligentDrakwebsite
    @intelligentDrakwebsite 5 месяцев назад

    system hydrogen

  • @k0d4x
    @k0d4x 3 месяца назад

    Költhetnél a kinézetedre egy kicsit mert kilométerekről látni, hogy informatikus vagy

  • @saywhat4229
    @saywhat4229 Год назад +2

    Shave your chin

  • @onionboy7271
    @onionboy7271 Год назад

    owning the new alert is not scary, the scary thing is no body wanted to entertain/help you to solve that together. Or higher tier solve them by themself without involving you and you are in the dark. What even worse, the alert is causing something down, you make it even worse~~~lol~~~

    • @MyDFIR
      @MyDFIR  Год назад +1

      Haha this is true - I take it you have experienced all of these? "higher tier solve them by themself without involving you and you are in the dark" This unfortunately happens so often but then there are times where the senior analyst actually put comments in the ticket on how they solved it but the junior analyst does not read & learn from it :(

    • @onionboy7271
      @onionboy7271 Год назад +1

      @@MyDFIR this is a channel where you not only getting something away from the content but from comment as well...😊
      most of the time, update in ticket from higher tier will not be details enough to understand what exactly has been done. maybe i'm too dumb to understand. I actually sometime reach out to higher tier and ask more about it and no getting response or they will say something like it's not tier 1 responsibility....story end.
      btw, your reply seem very ai...lol

    • @MyDFIR
      @MyDFIR  Год назад +2

      @@onionboy7271 LOL! I’ll take that as a compliment? 😂

  • @Stankfish420
    @Stankfish420 Год назад

    Hey bro, nice vid. Just wondering if it’s a complete must to have a degree for this field. I have former law enforcement experience but only a few semester of college completed. Currently working on getting a CompTIA A+ and a few more certs before applying for a help desk position. Thanks for any info!

    • @MyDFIR
      @MyDFIR  Год назад +1

      "Must have", no BUT will it help? 1000% Yes. - If you are in the position to obtain a relevant degree, I would say go for that option. CompTIA A+ is a great certificate to obtain to understand IT, good job on taking the initiative to work towards that cert. I have confidence that once you obtain A+, it will help you in search for that help desk position. Keep in mind that for junior roles, soft skills are more important than technical skills. Having both will make a killer combo.
      Good luck in your search & studies!

    • @Stankfish420
      @Stankfish420 Год назад

      @@MyDFIR thanks brother

    • @zigzagzallakabam4823
      @zigzagzallakabam4823 Год назад

      ​@MyDFIR would skipping a+ and just getting security+ be good for a helpdesk role? Previous helpdesk role experience, years ago though.

  • @sigma-yn3qd
    @sigma-yn3qd Год назад

    Soc analyst = tech support

    • @MyDFIR
      @MyDFIR  Год назад +3

      🤣to some degree, this is true - Instead of receiving phone calls you receive alerts haha

    • @blackamericanlesbianprofes4357
      @blackamericanlesbianprofes4357 Год назад

      That makes sense. But you, sigma-yn3qd, do realize tech support is a demanding job. Many individuals and companies need that support consistently because of costs, time, knowledge, etc.

    • @sigma-yn3qd
      @sigma-yn3qd Год назад

      @@blackamericanlesbianprofes4357 yes i know but it's still basically tech support

  • @mylosovich24
    @mylosovich24 Год назад

    Thank you!! Insta-sub here. Just taking my google/coursea foundation course, this has answered questions I had

    • @MyDFIR
      @MyDFIR  Год назад +1

      Awesome, I hope you enjoy the course and feel free to ask any questions that may pop up during the course.

    • @mylosovich24
      @mylosovich24 Год назад

      @@MyDFIR I can't thank you enough for posting your content already